Hello folks, I'm trying to figure out how to use digitally signed code...
OK, so I used PRCCert to create a keypair and a self-signed certificate: prccert -keygen -passphrase Test prccert -certgen -passphrase Test -keyfile Priv_Key.pem -configfile PRCCert.conf This resulted in the creation of the files Priv_Key.pem Publ_Key.pem Crt_File.der Then I tried to sign a PRC file: prcsign -keyfile Priv_Key.pem -passphrase Test -cert Crt_File.der MyApp.prc If I have understood the documentation correctly, this should add two resources to MyApp.prc - 'sign', containing the digital signature of the application's resources and 'cert', containing the certificate for the key with which this signature has been taken. In practice, however, only the 'sign' resource was added to the application. Now, how do I ensure the integrity of the application? The documentation suggests that the operating system itself (PalmOS Cobalt) should verify the integrity of the digitally signed applications - and, presumably, issue a warning if the verification fails. I started the Cobalt simulator, set the Current Security to Medium from the Security applet of the system preferences, then modified a single character in the signed application and loaded it into the simulator. The application ran just fine - no warnings whatsoever. Presumably, this is because of the missing 'cert' resource? Why wasn't it created - what did I do wrong? Or have I misunderstood and the OS isn't checking the integrity of the applications it runs - and the applications have to do it themselves with SignVerifySignatureByIndex or something? Regards, Vesselin -- For information on using the Palm Developer Forums, or to unsubscribe, please see http://www.palmos.com/dev/support/forums/
